CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments, and Cybersecurity Audits

Applies To

Overview

The California Privacy Protection Agency (CPPA) board adopted these regulations in July 2025. The Office of Administrative Law approved them on 22 September 2025, and they took effect on 1 January 2026. The ADMT rules apply when a business uses automated decisionmaking technology to make significant decisions about consumers, such as decisions on lending, housing, education, employment, or healthcare. Such businesses must give a pre-use notice, offer an opt-out unless an exception applies, and explain how the technology was used when consumers ask. ADMT used for significant decisions before 1 January 2027 must comply by that date; ADMT deployed later must comply before first use. Businesses whose processing presents significant risk to consumers' privacy must carry out risk assessments from 1 January 2026. They must submit an attestation and summary to the CPPA by 1 April 2028. Cybersecurity audit duties phase in by company size, with the first audit certifications due from 2028. The CPPA and the Attorney General enforce the rules, with administrative fines per violation that are higher for intentional violations.

Key Requirements

• •Conduct and document privacy risk assessments before initiating data processing activities that present significant risk to consumers, including selling or sharing personal information, processing sensitive personal information (no large-scale threshold), using ADMT for a significant decision, profiling in specified education/employment contexts or by sensitive location, and training ADMT or certain identification technologies on personal information.
• •Provide consumers with a clear opt-out mechanism for the use of automated decision-making technologies in consequential decisions affecting employment, credit, housing, education, and healthcare, among other domains.
• •Implement and maintain a cybersecurity audit program proportionate to the volume and sensitivity of personal data processed, with audit results subject to submission to the CPPA upon request.
• •Disclose to consumers when ADMT is being used to make or substantially influence a decision that affects them, including the logic involved and the categories of data used.
• •Retain risk assessments, original and updated, for as long as the processing continues or five years after completion, whichever is later. Keep cybersecurity audit documents for at least five years.
• •Fines are assessed per violation and are higher for intentional violations; amounts are adjusted for inflation.

What Your Organization Must Do

• →Inventory every automated decisionmaking tool used for lending, housing, education, employment or healthcare decisions.
• →Prepare pre-use notices and consumer opt-out paths for those tools before the 1 January 2027 deadline.
• →Start documenting privacy risk assessments now for processing that presents significant risk to consumers.
• →Calendar the attestation and risk assessment summary due to the California agency by 1 April 2028.
• →Scope your cybersecurity audit program to data volume and sensitivity, with first certifications due from 2028.
• →Build a process to answer consumer requests explaining how the technology was used in their decision.